Skip to content

Commit bec91e1

Browse files
keluniksgolemon
kelunik
authored and
sgolemon
committed
Use any TLS crypto method by default, don't use SSL
1 parent b50fe89 commit bec91e1

File tree

4 files changed

+67
-6
lines changed

4 files changed

+67
-6
lines changed

‎NEWS‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ PHP NEWS
55
- OpenSSL:
66
. Fixed bug #74720 (pkcs7_en/decrypt does not work if \x1a is used in
77
content). (Anatol)
8+
. Use TLS_ANY for default ssl:// and tls:// negotiation.
9+
(Niklas Keller, me at kelunik dot com)
810

911
- SQLite3:
1012
. Update to Sqlite 3.19.3. (cmb)

‎ext/openssl/tests/tls_wrapper.phpt‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
--TEST--
2+
tls stream wrapper
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded("openssl")) die("skip openssl not loaded");
6+
if (!function_exists("proc_open")) die("skip no proc_open");
7+
--FILE--
8+
<?php
9+
$serverCode = <<<'CODE'
10+
$flags = STREAM_SERVER_BIND|STREAM_SERVER_LISTEN;
11+
$ctx = stream_context_create(['ssl' => [
12+
'local_cert' => __DIR__ . '/streams_crypto_method.pem',
13+
]]);
14+
15+
$server = stream_socket_server('tls://127.0.0.1:64321', $errno, $errstr, $flags, $ctx);
16+
phpt_notify();
17+
18+
for ($i=0; $i < 6; $i++) {
19+
@stream_socket_accept($server, 3);
20+
}
21+
CODE;
22+
23+
$clientCode = <<<'CODE'
24+
$flags = STREAM_CLIENT_CONNECT;
25+
$ctx = stream_context_create(['ssl' => [
26+
'verify_peer' => false,
27+
'verify_peer_name' => false,
28+
]]);
29+
30+
phpt_wait();
31+
32+
$client = stream_socket_client("tlsv1.0://127.0.0.1:64321", $errno, $errstr, 3, $flags, $ctx);
33+
var_dump($client);
34+
35+
$client = @stream_socket_client("sslv3://127.0.0.1:64321", $errno, $errstr, 3, $flags, $ctx);
36+
var_dump($client);
37+
38+
$client = @stream_socket_client("tlsv1.1://127.0.0.1:64321", $errno, $errstr, 3, $flags, $ctx);
39+
var_dump($client);
40+
41+
$client = @stream_socket_client("tlsv1.2://127.0.0.1:64321", $errno, $errstr, 3, $flags, $ctx);
42+
var_dump($client);
43+
44+
$client = @stream_socket_client("ssl://127.0.0.1:64321", $errno, $errstr, 3, $flags, $ctx);
45+
var_dump($client);
46+
47+
$client = @stream_socket_client("tls://127.0.0.1:64321", $errno, $errstr, 3, $flags, $ctx);
48+
var_dump($client);
49+
CODE;
50+
51+
include 'ServerClientTestCase.inc';
52+
ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
53+
--EXPECTF--
54+
resource(%d) of type (stream)
55+
bool(false)
56+
resource(%d) of type (stream)
57+
resource(%d) of type (stream)
58+
resource(%d) of type (stream)
59+
resource(%d) of type (stream)

‎ext/openssl/xp_ssl.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2557,7 +2557,7 @@ php_stream *php_openssl_ssl_socket_factory(const char *proto, size_t protolen,
25572557

25582558
if (strncmp(proto, "ssl", protolen) == 0) {
25592559
sslsock->enable_on_connect = 1;
2560-
sslsock->method = get_crypto_method(context, STREAM_CRYPTO_METHOD_ANY_CLIENT);
2560+
sslsock->method = get_crypto_method(context, STREAM_CRYPTO_METHOD_TLS_ANY_CLIENT);
25612561
} else if (strncmp(proto, "sslv2", protolen) == 0) {
25622562
php_error_docref(NULL, E_WARNING, "SSLv2 unavailable in this PHP version");
25632563
php_stream_close(stream);
@@ -2573,7 +2573,7 @@ php_stream *php_openssl_ssl_socket_factory(const char *proto, size_t protolen,
25732573
#endif
25742574
} else if (strncmp(proto, "tls", protolen) == 0) {
25752575
sslsock->enable_on_connect = 1;
2576-
sslsock->method = get_crypto_method(context, STREAM_CRYPTO_METHOD_TLS_CLIENT);
2576+
sslsock->method = get_crypto_method(context, STREAM_CRYPTO_METHOD_TLS_ANY_CLIENT);
25772577
} else if (strncmp(proto, "tlsv1.0", protolen) == 0) {
25782578
sslsock->enable_on_connect = 1;
25792579
sslsock->method = STREAM_CRYPTO_METHOD_TLSv1_0_CLIENT;

‎main/streams/php_stream_transport.h‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -172,8 +172,8 @@ typedef enum {
172172
STREAM_CRYPTO_METHOD_TLSv1_0_CLIENT = (1 << 3 | 1),
173173
STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT = (1 << 4 | 1),
174174
STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT = (1 << 5 | 1),
175-
/* tls now equates only to the specific TLSv1 method for BC with pre-5.6 */
176-
STREAM_CRYPTO_METHOD_TLS_CLIENT = (1 << 3 | 1),
175+
/* TLS equates to TLS_ANY as of PHP 7.2 */
176+
STREAM_CRYPTO_METHOD_TLS_CLIENT = ((1 << 3) | (1 << 4) | (1 << 5) | 1),
177177
STREAM_CRYPTO_METHOD_TLS_ANY_CLIENT = ((1 << 3) | (1 << 4) | (1 << 5) | 1),
178178
STREAM_CRYPTO_METHOD_ANY_CLIENT = ((1 << 1) | (1 << 2) | (1 << 3) | (1 << 4) | (1 << 5) | 1),
179179
STREAM_CRYPTO_METHOD_SSLv2_SERVER = (1 << 1),
@@ -183,8 +183,8 @@ typedef enum {
183183
STREAM_CRYPTO_METHOD_TLSv1_0_SERVER = (1 << 3),
184184
STREAM_CRYPTO_METHOD_TLSv1_1_SERVER = (1 << 4),
185185
STREAM_CRYPTO_METHOD_TLSv1_2_SERVER = (1 << 5),
186-
/* tls equates only to the specific TLSv1 method for BC with pre-5.6 */
187-
STREAM_CRYPTO_METHOD_TLS_SERVER = (1 << 3),
186+
/* TLS equates to TLS_ANY as of PHP 7.2 */
187+
STREAM_CRYPTO_METHOD_TLS_SERVER = ((1 << 3) | (1 << 4) | (1 << 5)),
188188
STREAM_CRYPTO_METHOD_TLS_ANY_SERVER = ((1 << 3) | (1 << 4) | (1 << 5)),
189189
STREAM_CRYPTO_METHOD_ANY_SERVER = ((1 << 1) | (1 << 2) | (1 << 3) | (1 << 4) | (1 << 5))
190190
} php_stream_xport_crypt_method_t;

0 commit comments

Comments
 (0)